# Rule Documentation Form

*From Firewall Policy Management in Modern Security Operations by Maurizio Moroni. You may adapt this template for use in your own organization. Latest version: https://firewallpolicybook.com/downloads/*

Capture these fields for every rule so that an audit, or the next admin, can trace why the rule exists and when it should be revisited.

| Field | Entry |
|----------|----------------------|
| Rule ID | [ID] |
| Rule Name | [Name] |
| Action | [Allow / Deny / Drop] |
| Enforcement point | [Device, policy, or cloud control] |

## Source information

| Field | Entry |
|----------|----------------------|
| Type | [IP/Group/User] |
| Value | [Value] |
| Description | [Description] |

## Destination information

| Field | Entry |
|----------|----------------------|
| Type | [IP/Group/Service] |
| Value | [Value] |
| Description | [Description] |

## Protocol and ports

| Field | Entry |
|----------|----------------------|
| Protocol | [TCP/UDP/Other] |
| Ports | [Ports] |

## Security profiles

| Field | Entry |
|----------|----------------------|
| Antivirus | [Yes / No / N/A with justification] |
| IPS | [Yes / No / N/A with justification] |
| DLP | [Yes / No / N/A with justification] |
| URL Filtering | [Yes / No / N/A with justification] |
| Logging | [Log at session start/end, log forwarding profile] |

## Business justification

| Field | Entry |
|----------|----------------------|
| Purpose | [Purpose] |
| Application | [Application] |
| Business Owner | [Owner] |
| Duration | [Permanent/Until Date] |

## Approval

| Field | Entry |
|----------|----------------------|
| Approved By | [Name] |
| Date | [Date] |
| Expires | [Date or N/A] |
| Review date | [Date] |
| Exception reference | [Exception ID or N/A] |

## Metadata

| Field | Entry |
|----------|----------------------|
| Created | [Date] |
| Last Modified | [Date] |
| Change History | [Reference] |